The WordPress REST API comments endpoint let any user holding the moderate_comments capability update or delete a note (the block editor’s editorial comments, comment type ‘note’) without checking that they can edit the post the note belongs to. A user whose role can moderate comments but cannot edit a given post could therefore read, change and delete the private editorial notes attached to it. Fixed upstream in WordPress 7.1.4, 7.0.8 and 6.9.11.
This vulnerability affects the following application versions:
- WordPress 6.9
- WordPress 6.9.1
- WordPress 6.9.2
- WordPress 6.9.3
- WordPress 6.9.4
- WordPress 6.9.5
- WordPress 6.9.6
- WordPress 6.9.7
- WordPress 6.9.8
- WordPress 6.9.9
- WordPress 6.9.10
- WordPress 7.0
- WordPress 7.0.1
- WordPress 7.0.2
- WordPress 7.0.3
- WordPress 7.0.4
- WordPress 7.0.5
- WordPress 7.0.6
- WordPress 7.0.7
- WordPress 7.1
- WordPress 7.1.1
- WordPress 7.1.2
- WordPress 7.1.3